Questão 6 — CompTIA SY0-701 CompTIA Security+ Certification Exam
A software company is conducting third-party risk assessments as part of its security governance program. The company outsources customer data processing to a cloud service provider (CSP) and needs to evaluate the CSP's security posture before renewing the contract. Which of the following assessment methods would provide the MOST direct evidence of the CSP's actual security controls and operational practices?
- A. Request and review the CSP's SOC 2 Type II audit report, conduct a security questionnaire assessment, and perform a site visit to review control implementation.
- B. Review the CSP's marketing materials and general security documentation published on their public website.
- C. Conduct a penetration test on the CSP's publicly accessible systems without prior approval or coordination.
- D. Rely solely on industry certifications and assume all CSPs meeting those certifications maintain equivalent security standards.
Resposta correta:
A
Explicação
Explanation: Correct answer: A. Request and review the CSP's SOC 2 Type II audit report, conduct a security questionnaire assessment, and perform a site visit to review control implementation. The most comprehensive third-party assessment combines multiple methods: SOC 2 Type II reports provide independent auditor verification of controls over time, questionnaires assess specific organizational practices, and site visits confirm actual implementation. This multi-layered approach provides the strongest evidence. Marketing materials and public documentation are often superficial and not independently verified. Unauthorized penetration testing violates contract terms, legal agreements, and potentially computer fraud laws. While industry certifications are valuable, assuming all certified providers are equivalent ignores differences in implementation depth and organizational maturity. Effective third-party risk management requires due diligence beyond assumptions.
Quer todas as 907 questões por R$ 1,00?